Russian-Speaking Hackers Goad Users into Installing Havoc

A newly discovered phishing campaign is using social engineering to dupe victims into copying, pasting, and running the Havoc command-and-control framework on their computers, warn researchers from Fortinet.

See Also: Live Webinar | AI-Powered Defense Against AI-Driven Threats

Russian-speaking hackers using the social engineering technique known as “ClickFix,” which displays a fake error message and instructions for the error’s supposed resolution. The instructions are actually a directive to paste a malicious PowerShell command into a terminal or PowerShell.

The hackers also take steps to obscure communications between their command and control server and victim computers, FortiGuard Labs researchers wrote in report highlighting the threat actor’s use of SharePoint and Microsoft Graph API.

The attackers use multi-stage malware delivery to deploy a modified Havoc Demon Agent. Havoc is an open-source C2 framework similar to Cobalt Strike, Silver, and Winos4.0, often used in red teaming exercises and cyberattacks. Attackers modified Havoc to communicate with a SharePoint-hosted backend through the Microsoft Graph API, embedding malicious commands within trusted cloud-based infrastructure.

The attack begins with a phishing email containing an HTML attachment Documents.html. When opened, the file displays the fake error message instructing users to copy and execute a PowerShell command, which downloads and runs a remote PowerShell script hosted on SharePoint.

The PowerShell script employs evasion techniques, including sandbox detection, registry manipulation and infection tagging. If Python is not installed on the system, the script downloads a Python interpreter before executing a secondary Python-based shellcode loader.

The loader is hosted on SharePoint, includes debug messages in Russian and is designed to load shellcode into memory undetected.

The campaign further employs KaynLdr, a GitHub-based shellcode loader, to inject a modified Havoc Demon DLL into the infected system. The DLL initializes communication with the attacker’s SharePoint site, exploiting Microsoft Graph API for command execution.

The malware retrieves access tokens from Microsoft’s Identity Platform, allowing it to read and write data within SharePoint’s default document library.

Havoc Demon establishes persistence by creating two hidden files in SharePoint: {VictimID}pD9-tKoutC and {VictimID}pD9-tKin. These files act as covert channels for C2 communications, with the malware sending encrypted check-in requests and receiving commands from the attacker via the Microsoft Graph API.

The traffic blends seamlessly with legitimate Microsoft services, making it difficult to detect, researchers said.

The modified Havoc Demon supports various post-exploitation capabilities, including data exfiltration, file operations, payload execution and credential theft. The malware also enables attackers to manipulate Kerberos authentication, potentially granting elevated access within enterprise environments.